Vector35 / Vector35/binaryninja-api
Improve ARM/Thumb support
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Binary Ninja struggles to be useful in the face of Thumb code in ARM binaries. In an mixed-mode ARM/Thumb binary calls between ARM and Thumb code use the "BLX" instruction instead of "BL". This signifies that the LSB of the target address is a Thumb function and the processor must change mode to Thumb mode to execute it.
However, that means there are "odd" function pointers within the code and data that need special handling. Further, when you follow such an "odd" pointer, it brings you to the specific address and not the aligned address. In ARM (Thumb or not), and instruction can NEVER have its first byte on an odd address.
If a function is later identified to be Thumb vs. ARM it doesn't seem possible to change this setting. Maybe I'm missing how, since I'm relatively new to Binary Ninja (but I have decades of IDA experience).
I can't be certain about every platform/OS/compiler/etc, but at least with GNU binaries (like Android) there are often symbols that pointer directly to the start of arm or thumb functions and specify the type. These are often seen as "$t" or "$a" in the symbols.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are named. Start by locating the existing ARM and Thumb analysis paths, then inspect how BLX targets, odd function pointers, alignment, and GNU $t/$a symbols are represented. Done should include reliable mixed ARM/Thumb handling and a way to update a function's mode after identification.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100